JavaGolangJavaScriptSwiftAndroidRustMiddleware
4 hours ago
spring-security
spring-projects

7.2.0-RC1

⭐ New Features

  • Improve WebAuthn Registration Page no-script Handling
  • Support nonce-based Content Security Policy

🪲 Bug Fixes

  • Set Content-Type to application/x-www-form-urlencoded in OpaqueTokenIntrospector

🔨 Dependency Upgrades

  • Bump @antora/atlas-extension from 1.0.0-alpha.5 to 1.0.0-alpha.6 in /docs
  • Bump actions/upload-artifact from 7.0.1 to 7.0.2
  • Bump antora from 3.2.0 to 3.2.1 in /docs
  • Bump ch.qos.logback:logback-classic from 1.6.3 to 1.6.4
  • Bump ch.qos.logback:logback-classic from 1.6.4 to 1.6.5
  • Bump com.fasterxml.jackson:jackson-bom from 2.22.2 to 2.22.3
  • Bump com.webauthn4j:webauthn4j-core from 0.31.10.RELEASE to 0.31.11.RELEASE
  • Bump gradle-wrapper from 9.7.1 to 9.8.0
  • Bump gradle-wrapper from 9.8.0 to 9.8.1
  • Bump io.spring.develocity.conventions from 0.0.26 to 0.0.27
  • Bump io.spring.gradle:spring-security-project-plugin from 1.0.19 to 1.0.20
  • Bump io.spring.gradle:spring-security-release-plugin from 1.0.19 to 1.0.20
  • Bump org-jetbrains-kotlin from 2.4.20 to 2.4.21
  • Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.4 to 5.6.5
  • Bump org.hibernate.orm:hibernate-core from 7.4.10.Final to 7.4.11.Final
  • Bump org.hibernate.orm:hibernate-core from 7.4.11.Final to 7.4.12.Final
  • Bump org.hibernate.orm:hibernate-core from 7.4.12.Final to 7.4.13.Final
  • Bump org.htmlunit:htmlunit from 5.5.0 to 5.6.0
  • Bump org.mockito:mockito-bom from 5.23.0 to 5.24.0
  • Bump org.seleniumhq.selenium:selenium-java from 4.48.0 to 4.50.0
  • Bump org.seleniumhq.selenium:selenium-java from 4.48.0 to 4.51.0
  • Bump org.slf4j:slf4j-api from 2.0.19 to 2.0.20
  • Bump spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml from bf2c65c148fb74b6bd54417222662ef587463765 to 0c67c5e7c6641a18e76c520114ed0251303e77ed
  • Bump spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml from fa7e8a8f981064983e9468225e052f14af7c67d4 to 0c09eb4023e17dd6ca395a0f4e406a4f7506a58d
  • Bump spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml from fa7e8a8f981064983e9468225e052f14af7c67d4 to 798bca4d6aecf03e5166d85789c33c20a65499e1
  • Bump spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml from fa7e8a8f981064983e9468225e052f14af7c67d4 to bf2c65c148fb74b6bd54417222662ef587463765
  • Bump spring-io/spring-release-actions/compute-next-version from 0.0.6 to 0.0.7
  • Bump spring-io/spring-release-actions/schedule-milestone from 0.0.6 to 0.0.7
  • Bump spring-io/spring-security-release-tools/.github/actions/send-notification from 1.0.18 to 1.0.19
  • Bump spring-io/spring-security-release-tools/.github/workflows/build.yml from 1.0.18 to 1.0.19
  • Bump spring-io/spring-security-release-tools/.github/workflows/build.yml from 1.0.18 to 1.0.20
  • Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml from 1.0.18 to 1.0.19
  • Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml from 1.0.19 to 1.0.20
  • Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml from 1.0.18 to 1.0.19
  • Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml from 1.0.18 to 1.0.20
  • Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml from 1.0.18 to 1.0.20
  • Bump spring-io/spring-security-release-tools/.github/workflows/test.yml from 1.0.18 to 1.0.20
  • Bump tools.jackson:jackson-bom from 3.2.2 to 3.2.3

❤️ Contributors

Thank you to all the contributors who worked on this release:

@ziqin

4 hours ago
spring-security
spring-projects

7.1.2

🪲 Bug Fixes

  • Avoid spring-core in password encoder validation
  • Downgrade to Jackson 3.1
  • Empty or null scope claim in dynamic client registration request should be lenient
  • Ensure WebSession ID is not changed after token refresh (Reactive)
  • Fix to allow null servlet request/response in ServletOAuth2AuthorizedClientExchangeFilterFunction
  • Header Writers should not corrupt Jetty HttpFields state in reactive ResponseBodyEmitter handlers
  • NPE with authenticationValidator in OAuth2AuthorizationCodeRequestValidatingFilter
  • TokenType reference comparison is used in BearerTokenAuthentication

🔨 Dependency Upgrades

  • Bump @antora/atlas-extension from 1.0.0-alpha.5 to 1.0.0-alpha.6 in /docs
  • Bump actions/setup-java from 6.0.0 to 6.0.1
  • Bump antora from 3.2.0 to 3.2.1 in /docs
  • Bump antora from 3.2.0-rc.3 to 3.2.0 in /docs
  • Bump com.webauthn4j:webauthn4j-core from 0.31.9.RELEASE to 0.31.10.RELEASE
  • Bump gradle-wrapper from 9.7.0 to 9.7.1
  • Bump io-spring-javaformat from 0.0.47 to 0.0.48
  • Bump io.spring.develocity.conventions from 0.0.25 to 0.0.26
  • Bump io.spring.gradle:spring-security-release-plugin from 1.0.15 to 1.0.16
  • Bump io.spring.gradle:spring-security-release-plugin from 1.0.16 to 1.0.17
  • Bump io.spring.gradle:spring-security-release-plugin from 1.0.17 to 1.0.19
  • Bump io.spring.nullability:io.spring.nullability.gradle.plugin from 0.0.14 to 0.0.15
  • Bump io.spring.nullability:io.spring.nullability.gradle.plugin from 0.0.15 to 0.0.16
  • Bump org-jetbrains-kotlin from 2.4.10 to 2.4.20
  • Bump org.hibernate.orm:hibernate-core from 7.4.5.Final to 7.4.6.Final
  • Bump org.hibernate.orm:hibernate-core from 7.4.6.Final to 7.4.7.Final
  • Bump org.hibernate.orm:hibernate-core from 7.4.7.Final to 7.4.10.Final
  • Bump org.slf4j:slf4j-api from 2.0.18 to 2.0.19
  • Bump spring-io/spring-release-actions/compute-next-version from 0.0.5 to 0.0.6
  • Bump spring-io/spring-release-actions/compute-next-version from 0.0.6 to 0.0.7
  • Bump spring-io/spring-release-actions/get-todays-release-version from 0.0.5 to 0.0.6
  • Bump spring-io/spring-security-release-tools/.github/actions/send-notification from 1.0.17 to 1.0.18
  • Bump spring-io/spring-security-release-tools/.github/workflows/build.yml from 1.0.17 to 1.0.18
  • Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml from 1.0.15 to 1.0.17
  • Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml from 1.0.15 to 1.0.17
  • Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml from 1.0.17 to 1.0.18
  • Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-stage.yml from 1.0.16 to 1.0.17
  • Bump tools.jackson:jackson-bom from 3.1.6 to 3.1.7

🔩 Build Updates

  • Configure for Reproducible Builds
  • Manually Set RequestedSessionId in Tests

❤️ Contributors

Thank you to all the contributors who worked on this release:

@evgeniycheban, @petergphillips, and @seonwooj0810

4 hours ago
spring-security
spring-projects

7.0.8

⭐ New Features

  • Polish onetimetoken references

🪲 Bug Fixes

  • AuthenticatorTransport#values should include SMART_CARD
  • Empty or null scope claim in dynamic client registration request should be lenient
  • Fix HeaderWriterFilter race condition during async requests
  • Fix TokenType comparison logic
  • Fix typos in Javadocs
  • NPE with authenticationValidator in OAuth2AuthorizationCodeRequestValidatingFilter
  • SecurityContextHolderThreadLocalAccessor should not share SecurityContext instance across threads

🔨 Dependency Upgrades

  • Bump @antora/atlas-extension from 1.0.0-alpha.5 to 1.0.0-alpha.6 in /docs
  • Bump antora from 3.2.0 to 3.2.1 in /docs
  • Bump antora from 3.2.0-rc.2 to 3.2.0-rc.3 in /docs
  • Bump antora from 3.2.0-rc.3 to 3.2.0 in /docs
  • Bump gradle-wrapper from 8.14.5 to 8.14.6
  • Bump io-spring-javaformat from 0.0.47 to 0.0.48
  • Bump io.spring.develocity.conventions from 0.0.25 to 0.0.27
  • Bump io.spring.gradle:spring-security-project-plugin from 1.0.19 to 1.0.20
  • Bump io.spring.gradle:spring-security-release-plugin from 1.0.15 to 1.0.17
  • Bump io.spring.gradle:spring-security-release-plugin from 1.0.17 to 1.0.20
  • Bump org.slf4j:slf4j-api from 2.0.18 to 2.0.19
  • Bump org.slf4j:slf4j-api from 2.0.19 to 2.0.20
  • Bump spring-io/spring-release-actions/compute-next-version from 0.0.5 to 0.0.6
  • Bump spring-io/spring-release-actions/get-todays-release-version from 0.0.5 to 0.0.6
  • Bump spring-io/spring-security-release-tools/.github/actions/send-notification from 1.0.17 to 1.0.18
  • Bump spring-io/spring-security-release-tools/.github/workflows/build.yml from 1.0.15 to 1.0.17
  • Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml from 1.0.17 to 1.0.18
  • Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml from 1.0.17 to 1.0.18
  • Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml from 1.0.17 to 1.0.18
  • Bump spring-io/spring-security-release-tools/.github/workflows/test.yml from 1.0.17 to 1.0.18
  • Bump spring-io/spring-security-release-tools/.github/workflows/test.yml from ed473b4dafba053c63a453d2d88a89df3b3e18b3 to 9ca0acea761aa79d71c78cc462048c49ed5c4230

🔩 Build Updates

  • Configure for Reproducible Builds

❤️ Contributors

Thank you to all the contributors who worked on this release:

@Kehrlann, @bdshadow, @ngocnhan-tran1996, @therepanic, and @ttddyy

4 hours ago
spring-framework
spring-projects

v7.1.0-RC1

⚠️ Attention Required

  • Remove APIs marked as deprecated for removal in 7.1 #37455
  • Consistently treat 0 as no timeout in WebTestClient #37454
  • Consistently treat 0 as no timeout in MockMvc #37453
  • Consistently treat 0 as no timeout in RSocketServiceProxyFactory #37451
  • Consistently treat 0 as no timeout in HTTP client support #37425
  • Update default settings in WebFlux multipart handling to align with Spring Boot and Tomcat #36928
  • Apply proxy with system properties to the default client in ReactorClientHttpConnector #36654
  • ProblemDetail instance field set from the current URL path, does not respect RFC #35969

⭐ New Features

  • Support JsonUnit as an alternative to JSONassert for JSON comparison in test APIs #37490
  • Add RetryState-aware overloads for onRetrySuccess and onRetryFailure #37465
  • Consistently treat 0 as no timeout in AsyncServerResponse #37452
  • Destroy all filters in CompositeFilter despite failures #37445
  • Refine DataAccessUtils to improve null-safety #37438
  • Omit zero timeout in DefaultRetryPolicy.toString() #37437
  • Avoid splitting surrogate pairs in StringUtils.truncate() #37435
  • Support positive hexadecimal values in NumberUtils #37434
  • Support compilation of String concatenation with non-String operands in SpEL #37433
  • Fix nullability in LinkedCaseInsensitiveMap #37432
  • Align parsing of jdk.httpclient.allowRestrictedHeaders in JdkClientHttpRequest with the JDK #37422
  • Align restricted header handling in reactive JdkClientHttpRequest with non-reactive JdkClientHttpRequest #37417
  • Configure problem details rendering through WebMvcConfigurer #37416
  • Fix missing IDENTITY_FINISH characteristic in MergedAnnotationCollectors #37415
  • Reject @AliasFor value and attribute when both have length #37413
  • Give ErrorResponse.Interceptor access to the current request #37410
  • Honor Map.equals() and Map.hashCode() contracts in CompositeMap #37401
  • Support rendering problem details as views in @ExceptionHandler methods #37400
  • Render exceptions not handled by ExceptionHandler methods as problem details #37398
  • Further improve AnnotationAttributes.toString() #37396
  • Improve primitive array handling in AnnotationAttributes.toString() #37395
  • Exclude static methods from override check in AnnotatedMethod #37390
  • Include root cause when MySQLMaxValueIncrementer fails to commit #37389
  • Record MVC exceptions leading to HTTP 5xx as errors in observalibity stacks #37384
  • Revise getBeanNamesForType caching to cover ResolvableType-based lookups as well #37382
  • Support for Hibernate 8.0's BeanContainer SPI revision #37381
  • Improve pre-bound JDBC Connection exception message #37356
  • Reject Kotlin constructor default values in enhanced @Configuration classes #37350
  • Rewrite CssLinkResourceTransformer for a single pass memory efficient parsing #37348
  • Deprecate multi-batch batchUpdate variant in JdbcTemplate #37345
  • Introduce entry-based DSL for JdbcClient batch updates #37341
  • Honor Collection.remove() contract in CompositeCollection #37332
  • Exclude static methods from override check in AnnotationsScanner #37319
  • Support for JPA 4.0 package and module descriptor discovery #37316
  • Set first batch arg once while executing batch with generated keys #37308
  • Improve JdbcClient to align BatchSpec with StatementSpec #37307
  • Include enum array attributes in TypeNotPresentException probing #37153
  • Misleading port number defaults when parsing "Forwarded for" and "Forwarded by" header information #37114
  • Remove MatchableHandlerMapping #37093
  • Optimize get for all values in ServletRequestHeadersAdapter and ServletResponseHeadersAdapter #37080
  • RestClient.Builder.configureMessageConverters disables the implicit registration of default converters. #36747
  • Avoid update to request "Content-Type" for characterEncoding in ServletServerHttpRequest #36426
  • Remove code to set the ServletResponse contentType and characterEncoding properties from the "Content-Type" header #36352

🐞 Bug Fixes

  • Avoid int overflow for large Duration timeouts in ClientHttpRequestFactory implementations #37427
  • Annotations are inherited from package-private method in superclass in different package #37408
  • MVC MultipartParser requires Publisher on the classpath #37353
  • Fix container detection in RepeatableContainers.standardRepeatables() #37326

🔨 Dependency Upgrades

  • Upgrade to Micrometer 1.18.0-RC1 #37439
  • Upgrade to Reactor 2026.0.0-RC1 #37375

❤️ Contributors

Thank you to all the contributors who worked on this release:

@EsmaeilChitgar, @cookie-meringue, @guanchengang, @itsmevichu, @junhyeong9812, @lejuho, @ngocnhan-tran1996, @quaff, @rene-schakmann, and @xoruddl

4 hours ago
spring-framework
spring-projects

v7.0.10

⭐ New Features

  • Align DelegatingMessageSource fallback implementation with AbstractMessageSource #37383
  • HttpEntity(T, MultiValueMap) stores an HttpHeaders unchecked, causing IncompatibleClassChangeError inside RestTemplate #37358
  • Recognize relocated Mockito MockAccess interface in ProxyProcessorSupport #37342
  • Runtime compatibility with JPA 4.0 M7 and corresponding Hibernate 8.0 snapshots #37315
  • Avoid Kotlin reflection in MethodParameter for non-suspending functions #37300
  • Revise underscore naming fallback in SimplePropertyRowMapper #37297
  • Avoid useless queue ops in ConcurrentLruCache.clear() #37292
  • PathMatchingResourcePatternResolver misses jars on java.class.path whose path contains % #37280
  • Remove redundant whitespace in exception messages #37277
  • OpenInView does no longer work with HibernateTransactionManager #37273
  • Lazily handle setClientInfo/setNetworkTimeout in LazyConnectionDataSourceProxy #37261
  • Avoid redundant filtering in FilteredMap.size() #37256
  • Support NaN and inifinite float values in toString() for synthesized annotations #37244
  • Use ArrayList instead of LinkedList in CompositeRetryListener #37231
  • redirectedUrl() argument in MockMvcResultMatchers should be @Nullable #37230
  • Published Gradle module file is missing javadocElements and sourcesElements #37209
  • Introduce a builder for SpelParserConfiguration #37187
  • Protobuf support classes all implement getMessageBuilder() #37147
  • Allow null contextPath in ServerHttpRequest.Builder #37099
  • Log broker availability events as String messages #36856

🐞 Bug Fixes

  • Avoid unnecessary dependent-bean registration for autowire-by-type #37424
  • Handle zero readTimeout in JdkClientHttpConnector #37412
  • Race condition in PartGenerator.CreateFileState can lose the completion signal #37409
  • Paused executor with late shutdown leaks its worker thread (and the closed context) after close #37406
  • Fix hanging retries for Flux-returning methods with caching #37403
  • Avoid serving stale values after failed refill in AbstractIdentityColumnMaxValueIncrementer #37402
  • Copy cookies in RenderingResponse.from() #37378
  • Avoid phantom keys in LinkedCaseInsensitiveMap.computeIfAbsent #37351
  • Fix single-value adaptation for primitive array types in TypeMappedAnnotation #37349
  • CssLinkResourceTransformer fails for invalid CSS links #37336
  • Fix cached ID reuse after commit failure in MySQLMaxValueIncrementer #37322
  • Fix connection leak in MySQLMaxValueIncrementer #37321
  • @CacheEvict truncates Flux results to the first element #37309
  • ConcurrentLruCache.clear() can miss entries added while it's running #37287
  • Enforce disk usage limit when spilling part to disk #37285
  • Prevent double size decrement in ConcurrentLruCache #37268
  • LogAccessor.debug(CharSequence) eagerly renders LogMessage since spring-core 7 switched from spring-jcl to commons-logging #37266
  • WebFlux loses empty multipart file when the file part is not last. #37264
  • Complete empty Uni instances from the Mutiny reactive adapter #37259
  • DefaultAsyncServerResponse.writeAsync() discards previously configured AsyncWebRequest timeout #37257
  • Provide missing native image hints for proxied hibernate 8 query types #37251
  • Provide missing native image hint for StatelessSession proxy created by SharedEntityManagerCreator. #37249
  • Provide missing native image reflection hint for hibernate PersistenceUnitInfoDescriptor. #37247
  • Sort duplicate key codes in SQLErrorCodes #37235
  • Handle zero readTimeout in JdkClientHttpRequestFactory #37234
  • Wrong reconnection attempt count in ReactorNettyTcpClient #37223
  • Stored procedure OUT parameter values are lost outside a transaction as of 7.0.9 #37221
  • Avoid int overflow in expiration time calculations in MockMvc and FlashMap #37208
  • ScheduledAnnotationBeanPostProcessor doesn't correctly support bean destruction #37207
  • Normalize function return parameter lookup in CallMetaDataContext #37206
  • Fix out-of-bounds read for truncated percent-escape in opaque host #37203
  • ClassFileTransformerAdapter deadlocks between two persistence units under load-time weaving #37199
  • Fix Kotlin value class handling for suspending AOP methods #37191
  • Update to NullAway 0.14.0 and fix new warnings #37188
  • ProtobufJsonEncoder emits JSON array when media type is ndjson #37158
  • streamingMediaTypes in ProtobufJsonEncoder not a subset of encodableMimeTypes #37154
  • Align DataBufferUtils$WriteCompletionHandler exception handling with the read() side #37145
  • DataBufferUtils.read() with NettyDataBuffer on JDK 25 hangs indefinitely #37143
  • Release queued body token buffers on multipart cancel #37115
  • Preserve async API version resolver order #37096
  • ClientResponse.mutate() builder can modify originalResponse headers. #37086
  • Custom reason is overwritten by i18n message in ResponseStatusException.updateAndGetBody() #36984
  • Generate compilable code for non-finite floating-point values #36965
  • Render parameter type names in ClassFileMethodMetadata #36919
  • Honor sourceStart offset in AbstractXMLStreamReader#getTextCharacters #36914
  • Fix reserveMethodNames to reserve each supplied name #36912
  • Replace thread-unsafe SimpleDateFormat with DateTimeFormatter in AbstractMockHttpServletRequestBuilder #36772
  • MockHttpServletRequest.isRequestedSessionIdValid() does not follow Servlet 6.1 Javadoc #36631
  • Map version from @HttpExchange to RequestMappingInfo #36602
  • Ensure that ConversionService.canConvert(Enum) no longer throws an exception #34532

📔 Documentation

  • Fix incorrect class names in WebFlux and MVC docs #37467
  • Document the XXE threat model of SourceHttpMessageConverter #37407
  • Update instructions for importing projects into Eclipse IDE #37397
  • Fix syntax errors in the reference manual #37392
  • Fix Kotlin example in Spring MVC test docs #37388
  • Document usage of type attribute in JSP <form:input> tag #37376
  • Make CONTRIBUTING.md self-contained and add AGENTS.md #37372
  • Clarify ConcurrentReferenceHashMap reference semantics #37357
  • Add missing enclosing single quotes in Javadoc #37338
  • Fix MockMvc async requests example in documentation #37318
  • Add closing braces to examples #37305
  • Fix typos in Javadoc #37229
  • Further updates to Data Binding Content in Web Sections of Documentation #37228
  • Add missing closing parenthesis in WebFlux config reference example #37163
  • Use <<id,text>> instead of xref: for local links in reference docs #37161
  • Fix broken internal xref links in reference docs #37152
  • Fix Kotlin examples in the reference manual #37101
  • Document combining @Retryable with proxy-based features #37005
  • Update recommendations for web data binding #36789

🔨 Dependency Upgrades

  • Upgrade to Micrometer 1.16.8 #37440
  • Upgrade to Reactor 2025.0.8 #37374

❤️ Contributors

Thank you to all the contributors who worked on this release:

@Gabriel-Gerhardt, @Gimini-3, @SebTardif, @a-kogun, @cj848, @cookie-meringue, @dmitrysulman, @garvit-joshi, @geonheeryu, @guanchengang, @hunseonglee, @jhan0121, @junhyeong9812, @kodacme, @lejuho, @moonfruit, @msridhar, @ngocnhan-tran1996, @noojung, @renatomameli, @rene-schakmann, @shaggyinsomniac, @timtebeek, and @xoruddl

7 hours ago
spring-boot
spring-projects

v4.2.0-RC1

⭐ New Features

  • Apply the readAllBytes() optimization to deflated nested jar entries #52285
  • Improve uber jar performance by looking up classes and resources directly in nested jars #52246
  • Support RABBITMQ_DEFAULT_VHOST in Docker Compose RabbitMQ integration #51940
  • Support random root passwords in MariaDB and MySQL Docker Compose integration #51938
  • Improve auto-configuration sorting performance #51867
  • Allow properties migrator to fail application startup #51855
  • Add property to enable Caffeine async cache mode #51844
  • Check resource existence once when looking for deleted files #51841
  • Avoid parsing nested jar URLs for cached resource lookups #51827
  • Support provided-scope libraries when extracting an executable war #51372
  • Switch to ubuntu-resolute-builder as the default builder #51249
  • Provide a callback for customizing Tomcat's Server #50259

🐞 Bug Fixes

  • JarUrlClassLoader rejects valid class names since #52271 #52284
  • Resources containing spaces cannot be read from executable jars after #52246 #52280
  • gRPC client 'grpc' load balancing fails to bind with a NullPointerException when no child policies are configured #52269
  • OriginTrackedResource does not implement equals correctly #52268
  • OriginTrackedPropertiesLoader drops properties whose name starts with # or ! #52266
  • Logback ColorConverter unnecessarily parses its options for every log event #52262
  • JWTs are rejected when issuer-uri is empty and jwk-set-uri is set #52261
  • Package manifest attributes are missing for nested jars without directory entries #52259
  • Empty system property in TestPropertyValues is cleared instead of being restored to its empty value #52209
  • Graceful shutdown of Tomcat or Jetty may call back with REQUESTS_ACTIVE when stop is called immediately after shutDownGracefully on an idle server #52199
  • NettyWebServer stop may hang when called immediately after shutDownGracefully #52198
  • Prevent gRPC client properties from overriding user customizations #52194
  • MongoDB fails to connect when credentials contain a space #52169
  • Authentication fails when password configured in spring.elasticsearch.uris contains a colon #52167
  • Logging can be lost when a context is paused by the test context framework #52089
  • Fractions of a second are handled incorrectly when configuring gRPC service config durations #52087
  • Docker Compose support for MongoDB fails to connect when credentials contain a character that requires URL encoding #52085
  • Jersey does not use the endpoint ObjectMapper when Actuator is running on a separate port #51983
  • Configuration property descriptions may be lost when building incrementally with Gradle #51926
  • BasicJsonParser mishandles escaped characters in nested lists and maps #51909
  • Zero week value conversion fails with 'intValue cannot be extracted from WEEKS' exception #51895
  • App fails to start when using DevTools and manually configuring JDBC or R2DBC without spring-boot-jdbc or spring-boot-r2dbc #51891
  • Docker Compose support incorrectly recognizes MARIADB_ALLOW_EMPTY_PASSWORD instead of MARIADB_ALLOW_EMPTY_ROOT_PASSWORD #51889
  • Auto-configured Kotlinx Serialization JSON codec customization is not applied #51878
  • Unavoidable warning when using ubuntu-resolute-builder with tiny run image #51851

📔 Documentation

  • Fix typo in gRPC testing documentation #52188
  • Fix Gradle example for servlet-based gRPC servers #52086
  • Fix actuator endpoint property names in Javadoc #51887
  • Document InetAddressFilter limitations with respect to proxy servers #51864

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@CCCLL, @LindseyZ1205, @MycroCosmo, @NotAFlightRisk, @aalsanie, @anthonydahanne, @challa, @crapxxi, @dmitrysulman, @galenzo17, @geonheeryu, @hunseonglee, @janwaleed09, @khopland, @ksky8864, @lavinhoque33, @move-hoon, @ngocnhan-tran1996, @noojung, @ohchanKyu, @padosol, @rvullriede, @ryujungkyun, @scordio, @sharanrenukeshbharmshetty, @skdas20, @timtebeek, @xoruddl, and @zhoubiao188

7 hours ago
spring-boot
spring-projects

v4.1.2

7 hours ago
spring-boot
spring-projects

v4.0.9

⭐ New Features

  • Add TWENTY_SEVEN to JavaVersion enum #51422

🐞 Bug Fixes

  • JWTs are rejected when issuer-uri is empty and jwk-set-uri is set #52249
  • Package manifest attributes are missing for nested jars without directory entries #52244
  • OriginTrackedPropertiesLoader drops properties whose name starts with # or ! #52207
  • OriginTrackedResource does not implement equals correctly #52205
  • Graceful shutdown of Tomcat or Jetty may call back with REQUESTS_ACTIVE when stop is called immediately after shutDownGracefully on an idle server #52195
  • Empty system property in TestPropertyValues is cleared instead of being restored to its empty value #52125
  • MongoDB fails to connect when credentials contain a space #52121
  • NettyWebServer stop may hang when called immediately after shutDownGracefully #52119
  • Authentication fails when password configured in spring.elasticsearch.uris contains a colon #52047
  • Logging can be lost when a context is paused by the test context framework #51959
  • Docker Compose support for MongoDB fails to connect when credentials contain a character that requires URL encoding #51939
  • Jersey does not use the endpoint ObjectMapper when Actuator is running on a separate port #51937
  • BasicJsonParser mishandles escaped characters in nested lists and maps #51907
  • Zero week value conversion fails with 'intValue cannot be extracted from WEEKS' exception #51892
  • App fails to start when using DevTools and manually configuring JDBC or R2DBC without spring-boot-jdbc or spring-boot-r2dbc #51872
  • Docker Compose support incorrectly recognizes MARIADB_ALLOW_EMPTY_PASSWORD instead of MARIADB_ALLOW_EMPTY_ROOT_PASSWORD #51870
  • Auto-configured Kotlinx Serialization JSON codec customization is not applied #51842
  • NullPointerException can be thrown when using uber jars due to a race condition in NestedJarFileResources #51744
  • DevTools does not detect a reactive web environment #51708
  • Connection fails when rabbitmq Docker Compose service is configured to use SSL #51666
  • When server.reactive.session.cookie.same-site is not set, session cookies have no SameSite attribute #51636
  • OAuth2 resource server ignores authorities-claim-delimiter when set on its own #51619
  • In a reactive web application, Cloud Foundry security integration returns a 500 rather than a 503 when the cloud controller URL is unavailable #51613
  • Some assertion messages name the wrong parameter #51568
  • SBOM-related manifest attributes are missing from Maven-packaged wars #51551
  • Docker Compose integration for RabbitMQ skips credential fallbacks when an environment variable has no value #51546
  • jarmode tools commands print stacktrace instead of an error message #51540
  • Layer temp file is not deleted when layer creation fails #51519
  • NestedByteChannel.read(ByteBuffer) incorrectly returns 0 when buffer could not be filled #51515
  • Customizer null checks in HTTP client builders assert the wrong attribute #51509
  • developmentOnly and testAndDevelopmentOnly configurations do not specify any attributes causing potential resolution problems #51492
  • SQL Server Docker Compose integration may duplicate the JDBC URL's encrypt parameter #51467
  • SSL host config customizations may be lost during Tomcat initialization #51466
  • OAuth2ClientProperties are not available when a user-defined ClientRegistrationRepository bean is provided #51447
  • Source is not closed consistently by all JSON marshal testers #51417
  • JmsHealthIndicator leaks watchdog threads if start fails immediately #51412
  • File handle in SpringBootJoranConfigurator should be closed #51398
  • Validation of deprecated io.buildpacks.stack.id is too aggressive #51390
  • SSL host config customizations are lost when reloading SSL bundles #51290
  • Docker Compose ProcessRunner can hang or leave orphan processes #50963
  • Configuration property descriptions may be lost when building incrementally with Gradle #50489

📔 Documentation

  • Fix actuator endpoint property names in Javadoc #51869
  • Fix broken links from reference documentation to external Javadoc #51815
  • Remove reference to AppOptics in the reference guide as it has retired #51807
  • Fix broken links #51791
  • Update Spring Framework reference links #51750
  • Maven plugin documentation incorrectly references remote restart property #51743
  • Update testcontainers javadoc links #51739
  • Fix documented default of spring.test.database.replace #51709
  • Correct Jackson 3 Javadoc links #51660
  • Fix typo in deprecated Pushgateway base-url property metadata #51627
  • Remove references to Spring Data Geode #51563
  • Fix typos in service containers javadoc and reference documentation #51431
  • Document support for Java 27 #51424
  • Document SAML2 back-off in WebFlux security documentation #51421
  • Remove reference to removed SpringBootWebSecurityConfiguration #51411

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@2heunxun, @CCCLL, @CHISANW, @COBI-98, @DevJunz, @JunggiKim, @LindseyZ1205, @MacAlsandair, @SebTardif, @dlwldn30, @dmitrysulman, @fabio-grassi, @galenzo17, @icikle, @janwaleed09, @kdomo, @khopland, @ksky8864, @lavinhoque33, @msridhar, @ngocnhan-tran1996, @noojung, @ohchanKyu, @padosol, @piyushrajyadav, @rvullriede, @ryujungkyun, @scordio, @scottfrederick, @timtebeek, @vlsi, @xoruddl, @xxxxxxjun, @yyuneu, and @zhoubiao188

8 hours ago
Activiti
Activiti

7.21.0-rc.729

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.728...7.21.0-rc.729

10 hours ago
Activiti
Activiti

7.21.0-rc.728

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.727...7.21.0-rc.728